|  | 6.4 | Extended ACLs
| 6.4.1 | What are extended ACLs

Extended ACLs are used most often to test conditions because they provide a greater range of control than standard ACLs. You would use an extended ACL when you want to allow Web traffic but deny File Transfer Protocol (FTP) or telnet from non-company networks. Extended ACLs check for both source and destination packet addresses. They also can check for specific protocols, port numbers, and other parameters. This gives you more flexibility to describe what checking the ACL will do. Packets can be permitted or denied output based on where the packet originated and based on its destination. For example, the extended ACL can allow e-mail traffic from E0 to specific S0 destinations, while denying remote logins or file transfers. Let's assume that Interface E0 has been grouped to an extended ACL. This would mean that you used precise, logical statements to create the ACL. Before a packet can proceed to that interface, it is tested by the ACL associated with that interface. Based on the extended ACL tests, the packet can be permitted or denied. For inbound lists, this means that permitted packets will continue to be processed. For outbound lists, this means that permitted packets will be sent directly to E0. If test results deny permission, the packet will be discarded. The router's ACL provides firewall control to deny use of the E0 interface. When packets are discarded, some protocols return a packet to the sender, stating that the destination was unreachable. For a single ACL, you can define multiple statements. Each of these statements should reference the same identifying name or number, to tie the statements to the same ACL. You can have as many condition statements as you want, limited only by the available memory. Of course, the more statements you have, the more difficult it will be to comprehend and manage your ACL. Therefore, documenting ACLs prevents confusion. The standard ACL (numbered 1 to 99) might not provide the traffic-filtering control you need. Standard ACLs filter traffic based on a source address and mask. Standard ACLs also permit or deny the entire Internet Protocol (IP) suite. You might need a more precise way to control traffic and access. For more precise traffic-filtering control, you use extended ACLs. Extended ACL statements check for source address and for destination address. In addition, at the end of the extended ACL statement, you gain additional precision from a field that specifies the optional TCP or User Datagram Protocol (UDP) protocol port number. These can be the well-known port numbers for TCP/IP. A few of the most common port numbers are shown in Figure . You can specify the logical operation the extended ACL will perform on specific protocols. Extended ACLs use a number in the range 100 to 199.
| Web Links
| Server Access Lists